CIA P3 Internal Audit Plan: practice questions with answers

Question 1

Merrow Brands completes the acquisition of a payments company in another country. The subsidiary has its own IT systems and has never been audited by Merrow's internal audit function. What should the CAE do with respect to the audit universe?

1. A Add the subsidiary's processes, systems and entities to the audit universe and include them in the next risk assessment
2. B Exclude the subsidiary from the audit universe until it has operated under Merrow's ownership for one full financial year
3. C Include the subsidiary only if the board specifically requests an engagement on the acquired business
4. D Treat the subsidiary as covered by the parent company's existing auditable units for planning purposes

Show the answer

Answer: A. The audit universe is the full set of auditable units (entities, processes, functions, systems, projects) in the organization. It must be kept current when the organization changes. A new subsidiary with its own systems and an unfamiliar regulatory environment is often higher risk, so it should be added to the universe and assessed in the next documented risk assessment that underpins the plan.

Question 2

The draft internal audit plan of Penrose Retail includes no work related to fraud risk. The CAE explains that the external auditor considers fraud in the financial statement audit. What is the MOST appropriate assessment of the draft plan?

1. A The draft is appropriate, because fraud risk is fully covered whenever an external financial statement audit is performed
2. B The draft is appropriate, because fraud prevention and detection are management's responsibility and not internal audit's concern
3. C Fraud risk coverage should be considered, because the external auditor focuses on material financial statement misstatement
4. D The draft should be revised so that internal audit investigates every fraud allegation instead of the second line

Show the answer

Answer: C. Standard 9.4 states that the internal audit plan must consider coverage of information technology governance, fraud risk, the effectiveness of the organization's compliance and ethics programs, and other high-risk areas. The external auditor's consideration of fraud is limited to risks of material misstatement in the financial statements, so it does not replace internal audit's evaluation of how the organization manages fraud risk more broadly.

Question 3

Brennock Council's internal audit function audits every auditable unit once every four years, regardless of risk. The new CAE wants to move to a risk-based approach. Which approach is MOST appropriate?

1. A Set frequency by assessed risk, cover lower-risk units less often or via other assurance, and keep legally required audits
2. B Keep the four-year rotation, because it guarantees equal and predictable coverage of every auditable unit in the organization
3. C Audit only the five highest-risk units each year and remove all other units from the audit universe
4. D Audit every auditable unit every year, so that no risk in the organization can be overlooked by internal audit

Show the answer

Answer: A. A risk-based plan allocates internal audit resources according to the documented risk assessment. High-risk areas are covered more often; lower-risk areas may be covered less frequently or through reliance on other assurance providers, but they stay in the audit universe and are reassessed. The CAE must also identify and include any engagements required by laws or regulations (Standard 9.4).

Question 4

Each year, Kelso Transport's internal audit plan includes testing of IT general controls over its financial systems. The function has never examined how IT investment decisions are made, how the IT strategy supports business objectives or how IT performance is overseen. Which requirement of Standard 9.4 does this plan MOST clearly fail to address?

1. A The plan must include all assurance services required by laws or regulations
2. B The plan must be approved by the chief information officer before the board
3. C The plan must consider coverage of information technology governance
4. D The plan must test IT general controls over every system at least annually

Show the answer

Answer: C. Standard 9.4 states that the internal audit plan must consider coverage of information technology governance, fraud risk, the effectiveness of the organization's compliance and ethics programs, and other high-risk areas. IT governance concerns how IT decisions are made, how IT strategy supports organizational objectives and how IT performance and risk are overseen. Testing IT general controls over financial systems is valuable but narrower, so the CAE should assess IT governance risk and consider it in the plan.

Question 5

The CAE of Cautley Construction is reviewing sources of potential engagements. Which piece of information gives the STRONGEST indication that an engagement on subcontractor selection in the northern region should be considered for the plan?

1. A Ethics hotline reports alleging favoritism in subcontractor awards in the northern region have tripled over the past year
2. B Subcontractor spend in the northern region grew by 4% this year, in line with growth in the region's revenue
3. C The external auditor's management letter reported no matters relating to procurement in the northern region
4. D The northern region's procurement manual was moved into the company's new document template during the year

Show the answer

Answer: A. The CAE draws potential engagements from many sources: the risk assessment and enterprise risk register, strategic plans, management and board requests, prior audit results, regulatory and external audit findings, data analytics, and information from ethics hotlines and investigations.

The value of a source depends on how directly it signals a change in risk. A tripling of hotline allegations about favoritism in one process and region is specific, recent and fraud-related, and it should lead the CAE to reassess the risk and consider an engagement (and to coordinate with any investigation). The other items are either expected changes, reassuring information or administrative changes.

Question 6

Westbrook Credit has outsourced its card-payment processing to a third-party processor that handles all customer card transactions. The CAE rates the related risk as high. How should the CAE address this risk in the internal audit plan?

1. A Exclude the risk, because outsourcing transfers responsibility for card processing to the third-party processor
2. B Assess existing assurance, such as service-organization reports and audit rights, and plan vendor-oversight work
3. C Plan to audit the processor's internal controls directly, without regard to contractual rights or other assurance
4. D Rely entirely on the processor's annual self-declaration that it has complied with the contract's terms

Show the answer

Answer: B. Outsourcing an activity does not transfer accountability for its risks. When planning, the CAE considers third-party risk like any other high risk: what assurance exists (for example, independent service-organization control reports or certifications), whether the contract gives audit rights, and how effectively management monitors the provider. Internal audit can then plan an engagement on third-party risk management or direct work at the provider, coordinating with other assurance providers (Standards 9.4 and 9.5).